FIPS-Compliant Deployment

Deepgram provides FIPS 140-3 self-hosted images for the API, Engine, License Proxy, and Billing containers, plus models encrypted using FIPS-approved algorithms.

Use the FIPS variants (the -fips tag suffix) of API, Engine, and License Proxy images from a recent self-hosted release. See the release changelog for specific release versions and tags.

FIPS mode is set per service. Add the following block to the configuration file of every service you deploy:

[fips]
mode = "enabled"

Set it in each of:

• api.toml (API)
• engine.toml (Engine)
• license-proxy.toml (License Proxy)
• billing.toml (Billing — airgapped deployments only)

The FIPS images do not enable FIPS mode on their own. A service whose configuration omits this block runs OpenSSL in standard (non-FIPS) mode, even on a FIPS image.

Confirm each service logs both openssl_fips_enabled=true and has_fips_encryption=true at startup. openssl_fips_enabled reports only that FIPS mode was requested and the OpenSSL FIPS provider loaded, so on its own it does not establish that a service is running FIPS-validated cryptography.

On Kubernetes, the Deepgram self-hosted Helm chart renders these configuration files, so set global.fips.enabled: true (chart 0.43.0 or later) instead of editing them directly. The chart requires a -fips image tag on every deployed component when that value is set.

As with any self-hosted Engine deployment, the Engine container requires these NVIDIA environment variables:

NVIDIA_VISIBLE_DEVICES=all
NVIDIA_DRIVER_CAPABILITIES=compute,utility

These are set in your container orchestration configuration. See the reference configs for Docker and Kubernetes.

Customers must provide their own full-chain PKI certificate for the API’s HTTPS endpoint.

Your Deepgram account team provides download links for the FIPS-encrypted models compatible with these images. FIPS models use the .dgv2 encrypted file format.

Flux STT is not currently supported on FIPS images. Flux STT can only be run on standard (non-FIPS) images.

Flux TTS runs on FIPS images. Flux TTS is subject to the MP3 and FLAC output issue below: batch /v2/speak requests return MP3 unless they set encoding, so set it explicitly. Streaming /v2/speak output is unaffected.

MP3 and FLAC output are not available on FIPS images. This is a known issue. A text-to-speech request that asks for either format returns HTTP 200 with an empty body rather than an error.

/v1/speak and batch /v2/speak both return MP3 when the request does not set encoding, so set encoding explicitly on FIPS images. Streaming /v2/speak returns linear16 and is unaffected.

Format support on FIPS images:

• linear16 and opus are unaffected, and are the recommended formats.
• mp3 and flac are unavailable.
• Verify any other format against your own deployment before relying on it.

This limitation applies to audio output only. Speech-to-text requests that submit MP3 or FLAC input are unaffected.

The FIPS API image enforces TLS 1.3 exclusively. It rejects TLS 1.2 connections outright and rejects non-FIPS cipher suites (such as ChaCha20). Any TLS-1.2-only client, SDK, or proxy in front of the API will fail to connect.

Ensure your entire client stack negotiates TLS 1.3 before cutover.

The deployment above reaches Deepgram’s hosted license server through the License Proxy, which requires outbound internet access. If you require running FIPS-compliant self-hosted Deepgram deployments in environments without public internet connectivity, contact your Deepgram account team to inquire about airgapped access, which uses the FIPS Billing image to run license validation offline.

• Deploy STT Services - Standard deployment guide
• Status Endpoint - Monitor node health and readiness